hash the password when user signup or login
fix the body-parser deprecated warning
apply the session store to mongodb